syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

1
vote
1answer
321 views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
4
votes
1answer
699 views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
2
votes
2answers
161 views

Load Balancing UDP traffic transparently

Are there any products (preferably open source) that can load balance UDP packets transparently? We need to scale our syslog servers and require the original source IP be kept intact. Alternatively ...
2
votes
1answer
381 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
2
votes
2answers
141 views

Send logs to mulitple syslog servers

we have a cisco 6500 chasis and I would like to send to the logs to two separate syslog servers. At present, it is already sent to one syslog server. That goes to our security team. But we would like ...
0
votes
1answer
136 views

NTP synchronisation not visible in syslog

I am trying to set up a local NTP server for our LAN. I am able run ntpdate server_ip to manually update the time. However, ntp daemon does not seem to be logging anything into syslog, and so I can't ...
2
votes
1answer
362 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
1
vote
1answer
250 views

cPanel and forwarding logs to the remote syslog server

I have fully working remote syslog server which receiving logs from servers and devices. I have try to setup cPanel/WHM syslog to forward logs to that remote server but so far I'm not seeing anything ...
2
votes
1answer
79 views

Disable syslog remote connections

I'm securing a server and closing all the ports that are not used, but i can't close the syslogd port, even worse I cannot find where the syslogd is called. This is what sockstat shows me: USER ...
1
vote
1answer
249 views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...
1
vote
1answer
145 views

syslogd filtering not working on FreeBSD

I am failing to get filtering by program or facility working in FreeBSD syslogd. I added local6.debug /var/log/test.log !testd *.debug /var/log/test.log to my ...
1
vote
3answers
66 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
2
votes
1answer
586 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
3
votes
3answers
130 views

To use syslog or not [closed]

Can someone make a decent case here: I want to use syslog so logging is integrated and so I can direct it based on severity etc not to mention log rotate, but at the same time I like the idea of ...
1
vote
1answer
272 views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
2
votes
2answers
208 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
2
votes
1answer
1k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
0
votes
1answer
114 views

syslog-ng 2.0.9 closing tcp connections from some clients instantly..?

I've a syslog-ng instance on 2.0.9, which is old, but... this is enterprise IT and upgrading the versions is... fun... running on Solaris 10. I have this strange problem where some clients stop being ...
0
votes
0answers
146 views

FreeBSD 7 syslog messages: “kernel: 15.xxxxxxxxxxxxxxx too long” (or “too short”)?

I'm experiencing poor performance on an old FreeBSD system and the only anomaly I see so far are syslog messages of the form: Jul 1 12:10:50 myserverXXX kernel: 16.0ccdd219377c0d80 too long Jul 1 ...
1
vote
1answer
246 views

Logstash shipper & server on the samebox

I'm trying to setup a central logstash configuration. However I would like to be sending my logs through syslog-ng and not third party shippers. This means that my logstash server is accepting via ...
3
votes
2answers
457 views

What is this in my syslog and should I be concerned?

I'm seeing a lot of the following line in /var/log/syslog: Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 ...
1
vote
0answers
79 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
3
votes
2answers
1k views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
0
votes
1answer
119 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
1
vote
2answers
1k views

How do I stop postfix log info going into syslog?

We have a vps running Ubuntu 10.04.4 LTS, and while trying to find a solution to a php problem, I've become aware of what looks like a problem with the syslog system - I'm not sure though. The ...
2
votes
1answer
772 views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
-2
votes
2answers
195 views

Syslog-ng.conf csv parser lost first columns

I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see: source s_network { ...
3
votes
3answers
343 views

Server crashes Sundays at 6 a.m. - out of memory

I have a weird problem: Every Sunday at 6 am my LAMP server crashes. Looking at the logs I see about 500 apache2 processes at the time (this is a test server without any load - especially not at 6 am) ...
-1
votes
2answers
318 views

Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)

I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
4
votes
1answer
619 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
0
votes
1answer
153 views

syslog-ng stopped and don't want to start

I noticed lately that my syslog is empty. I tried restarting it but i get this error: $ /etc/init.d/syslog-ng reload Reload system logging: syslog-ngsyntax error in /etc/syslog-ng/syslog-ng.conf at ...
0
votes
2answers
195 views

log server setup and testing, with log manager opensource

I've been trying to get a new, centralized, log-server up and running for some testing and have run into some problems. First part is that I've installed Kibana but can't get anything indexed, tried ...
1
vote
2answers
540 views

SSD read errors; should I be worried?

An SSD just over a month old is producing read errors in my syslog whenever rsync backs it up: [276877.360221] ata1.00: exception Emask 0x0 SAct 0x1 SErr 0x0 action 0x0 [276877.360226] ata1.00: ...
0
votes
1answer
86 views

Can Rsyslog process messages before saving them?

The messages that I'm sending to syslog have some tags like so: "[date] [text here] tags:tag1,tag2,tag3 [more text here]" I already have a rule that only saves lines that contain the text "tags:" ...
2
votes
3answers
4k views

CentOS 6: strange page allocation failure messages [duplicate]

I set up a new Server with CentOS 6.4 final as successor for an old mysql server and I'm facing some problems with it. From time to time mysql connections are being disconnected. Furthermore the ...
0
votes
0answers
57 views

VMware ESX/i syslog content

I am working on an expansion of our monitoring footprint, and we are currently looking at including data from our visualized environment. As our monitoring license is based on logged volumes, and we ...
0
votes
1answer
159 views

Can I collect Syslog events in the Windows Event Collector? [duplicate]

I have a couple of *nix based systems that I'd like to start collecting logging information for. Is there a way to forward Syslog events to a Widnows server running the Windows Event Collector ...
1
vote
1answer
289 views

ubuntu server becomes unresponsive via web, ftp, ssh and more

I have a ubuntu server hosted and a couple of times it becomes unresponsive to everything, until a hard reboot is done.. i have pulled the logs but i need a little bit of help working out what they ...
0
votes
2answers
468 views

Setting up SysLog on Windows

I'm trying without any luck to use NTSysLog in order to grab my network computers Security Logs and send them into a Log Service (Loggly in this case). I can install and run NTSysLog from a Windows 7 ...
1
vote
1answer
390 views

Netflow to syslog converter

Is there any way to have netflow v9 converted to syslog? Which would be the best way to have the following idea working? Procedure: 1) The router sends UDP with the following structure: ...
0
votes
2answers
150 views

Is it possible to modify the date/time format for sendmail logs?

CentOS 5.x | SendMail I'm cross-referencing logs with another application/server and would like to change the date format on the SendMail maillog. Presently it's MMM DD HH:MM:SS Is there any way ...
3
votes
3answers
271 views

Find out how long a user was logged into a Linux server

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0) ...
-1
votes
2answers
190 views

Server reboots, no idea why [closed]

I'm by no means experienced with system administration. I have a Linode vm mostly for the fun of it, hosting a webserver (nginx -> nodejs) and a Minecraft server I share with some friends. I ...
1
vote
0answers
100 views

Writing templates for rsyslog

When I'm trying to send log from rsyslog to syslog-ng, the hostnames are getting shortened. Instead of inbound.server.com, I only recieve inbound at the syslog-ng side even though I have FQDN option ...
0
votes
2answers
1k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
2
votes
1answer
374 views

Sending output from php script called from bash script to syslog

Sending output from php script called from bash script to syslog Im trying to create a bash script (to be called by a cron job) which calls a php file (which I have not made). Calling the php file is ...
2
votes
1answer
176 views

Rsyslog messages are truncated, not sent to the correct file

On Ubuntu 10.04 LTS, I'm using the stock rsyslog configuration and added a custom file in /etc/rsyslog.d with the following contents: # cat /etc/rsyslog.d/62-pc local3.debug /var/log/pc/debug.log ...
2
votes
2answers
353 views

rsyslog - regex trouble

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format ...
1
vote
1answer
80 views

In logrotate, where does postrotate log errors?

If there are errors in the postrotate script block, where are they logged in Ubuntu?
3
votes
2answers
1k views

Use a Mac (10.8) as a remote log server

I'm trying to use my Mac Mini server as a remote log server for our router. I set the router to forward the logs to the server but I'm not seeing the logs anywhere in the console app. Am I missing ...